tmp_suning_uos_patched/drivers/infiniband/hw/ocrdma
Tom Rix 0dbfad171b RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()
commit f2bc3af6353cb2a33dfa9d270d999d839eef54cb upstream.

In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable
pd and then after uctx->cntxt_pd is freed, the variable pd is passed to
function _ocrdma_dealloc_pd() which dereferences pd directly or through
its call to ocrdma_mbx_dealloc_pd().

Reorder the free using the variable pd.

Cc: stable@vger.kernel.org
Fixes: 21a428a019 ("RDMA: Handle PD allocations by IB/core")
Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-19 18:27:21 +01:00
..
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
ocrdma_ah.c RDMA: Restore ability to fail on AH destroy 2020-09-09 13:57:22 -03:00
ocrdma_ah.h RDMA: Restore ability to fail on AH destroy 2020-09-09 13:57:22 -03:00
ocrdma_hw.c RDMA/ocrdma: Remove fbo from MR 2020-09-11 10:24:54 -03:00
ocrdma_hw.h RDMA: Clean destroy CQ in drivers do not return errors 2019-06-11 16:17:10 -04:00
ocrdma_main.c RDMA: Explicitly pass in the dma_device to ib_register_device 2020-10-16 13:53:46 -03:00
ocrdma_sli.h RDMA/ocrdma: Fix spelling mistake in variable name 2019-11-14 11:51:42 -04:00
ocrdma_stats.c RDMA/ocrdma: Fix spelling mistake in variable name 2019-11-14 11:51:42 -04:00
ocrdma_stats.h RDMA/ocrdma: Make ocrdma_pma_counters() return void 2019-11-06 15:38:57 -04:00
ocrdma_verbs.c RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() 2021-01-19 18:27:21 +01:00
ocrdma_verbs.h RDMA: Allow fail of destroy CQ 2020-09-09 14:14:29 -03:00
ocrdma.h RDMA/ocrdma: Remove fbo from MR 2020-09-11 10:24:54 -03:00